VSCODE

[hyb80]

Hi

 

Im not familiar with this one so just asking for some advice.

 

Head of computing has asked for Vscode to be installed which itself i dont have a problem with. Now hes trying to run coding on some raspberry picodes which wants to launch in a powershell window which is blocked.

 

To enable the powershell window I have to allow powershell.

 

Anyone had any experience with deploying this software.

[supportman]

Yes we use it for all our CS department, it runs well. It needs various access rights to do things but all depends what they are working on really.

 

I've not come up against powershell here but we allow python 3.8 access from the c: drive.

[hyb80]

Great. Do you just configure it in the settings to use the python instead of Powershell.?

[supportman]

Great. Do you just configure it in the settings to use the python instead of Powershell.?

 

Yes you can set it up in the project settings to use different runtimes.

[mavhc]

What exactly wants to run in powershell? Why is powershell blocked?

[Primus]

What exactly wants to run in powershell? Why is powershell blocked?

 

I mean I agree with asking what exactly wants to run in PowerShell but I'd consider blocking PowerShell to be pretty standard in education settings - asking why it's blocked isn't helpful.

[supportman]

We don't block it here or python.

[Primus]

We don't block it here or python.

 

Interesting. So do you limit what they can do with PowerShell then?

[supportman]

Interesting. So do you limit what they can do with PowerShell then?

 

No not at all, our students are pretty good to be fair. Never had any issues with that, we removed a lot of the old restrictive policies when we introduced Computer Science many years ago now.

[Primus]

No not at all, our students are pretty good to be fair. Never had any issues with that, we removed a lot of the old restrictive policies when we introduced Computer Science many years ago now.

 

I'd seriously look again at this, if you're not limiting their access to PowerShell then there's a whole range of exploits available.

 

Out of interest do you limit their access to CMD?

[Mark182]

What happens when you get one bad apple student?

[Primus]

For context - as well as managing our infrastructure I'm also HoD for Computer Science so I get the balancing act that's needed and you can't be too restrictive! However there's no way I'd allow access to PowerShell to any of our end users.

[MartinByard]

We've found that if you block access to powershell it has the unfortunate side effect of stopping our powershell logon scripts running ....

[Primus]

We've found that if you block access to powershell it has the unfortunate side effect of stopping our powershell logon scripts running ....

 

There are ways around this such as signing your scripts.

[mavhc]

I mean I agree with asking what exactly wants to run in PowerShell but I'd consider blocking PowerShell to be pretty standard in education settings - asking why it's blocked isn't helpful.

 

If you don't know why it's blocked then how can you provide useful advice?

[Primus]

If you don't know why it's blocked then how can you provide useful advice?

 

Do you block access to PS?

[mavhc]

Do you block access to PS?

 

Me? No. If there's a flaw in the security then it's not powershell's fault, it's the security settings. Can exploit the same flaw in python, javascript, assembler, doesn't matter.

[supportman]

I'd seriously look again at this, if you're not limiting their access to PowerShell then there's a whole range of exploits available.

 

Out of interest do you limit their access to CMD?

Yes we block CMD launch, but anyone with year 7 Python knowledge knows how to get around it

 

Honestly I think the days of harshly locking down workstations are over, we did the same years ago but have slowly loosened the security over the years without any major issues.

 

Of course we get the odd machine that's been fiddled with, but we can re-image in a 20 minutes remotely.

 

I think in our job its important to create a balance of security vs teaching. It can depend on the school of course.

[Primus]

Me? No. If there's a flaw in the security then it's not powershell's fault, it's the security settings. Can exploit the same flaw in python, javascript, assembler, doesn't matter.

 

Ok, so I'm assuming you also don't block CMD?

[mavhc]

Ok, so I'm assuming you also don't block CMD?

 

Correct, nor task manager. Not running windows 98 after all.

[Primus]

Yes we block CMD launch, but anyone with year 7 Python knowledge knows how to get around it

 

Honestly I think the days of harshly locking down workstations are over, we did the same years ago but have slowly loosened the security over the years without any major issues.

 

Of course we get the odd machine that's been fiddled with, but we can re-image in a 20 minutes remotely.

 

I think in our job its important to create a balance of security vs teaching. It can depend on the school of course.

 

If you block CMD properly then you can't get around it.

 

There is of course a balance, however under the Data Protection Act you are under a legal obligation to ensure that certain data is protected etc.

 

I don't consider blocking CMD and PS to be harshly locking down a workstation.

 

Even if your users are entirely harmless, there's nothing to stop them accidentally infecting your network with ransomware etc.

[Primus]

Correct, nor task manager. Not running windows 98 after all.

 

Ok, so for argument's sake let's say you have an eSafety application running such as NetSupport DNA - if you grant access to Task Manager students can now forcibly quit this application. How do you prevent them from doing that?

[localzuk]

Ok, so for argument's sake let's say you have an eSafety application running such as NetSupport DNA - if you grant access to Task Manager students can now forcibly quit this application. How do you prevent them from doing that?

NetSupport DNA would be running in an elevated user account wouldn't it? Not the actual user account logged in? So the end user would need admin privs to end that process?

[localzuk]

Honestly I think the days of harshly locking down workstations are over, we did the same years ago but have slowly loosened the security over the years without any major issues.

With GDPR, the increased risks of ransomware, etc...? I'd say there's far more reason to lock a PC down now than ever before.

[free780]

You can only do in PowerShell what you standard user can do.

Blocking isn't necessarily the answer.

Auditing and having AppLocker making sure constrained language mode is a start.

You can also scripts from Microsoft via AppLocker. Alerting isn't too hard to setup if you forward events to a server and do a scheduled task to send a email.